PHP2Shell is the popular name given to two critical, unauthenticated, remote code execution (RCE) vulnerabilities in the core PHP runtime engine: CVE-2026-109618 and CVE-2026-109619.
On October 21, 2026, it was announced that these vulnerabilities carry a critical CVSS v4.0 score of 9.2. Because the flaws exist within PHP’s underlying request-processing and memory-management lifecycles, an attacker can execute arbitrary commands on a server regardless of how secure the actual website software (such as WordPress, Drupal, Magento and so many more) is.
Then the Emergency Patches came out.
I heard about it on the 22nd. On the night of the 23rd I had upgraded PHP for my VPS and every client site was secured and verified. My clients count on me, so no half measures. I updated everything to the very latest.
As AI continues to grow and integrate with our lives, these kind of risks are bound to increase in frequency and intensity.
If you are wondering about your website, give me a call and I will check it for you.
Om the coming months many sites that did niot follow these warnings will succumb to hackers.
The primary and most effective remediation is to update your PHP engine immediately to the latest patched releases:
- PHP 8.5 ➔ Update to 8.5.12 or higher
- PHP 8.4 ➔ Update to 8.4.27 or higher
- PHP 8.3 ➔ Update to 8.3.36 or higher
- PHP 8.2 ➔ Update to 8.2.35 or higher
Note on End-of-Life (EOL) Versions: PHP 8.1, 8.0, and 7.4 do not receive official upstream releases from the PHP Foundation, though minimal source code backports have been provided. If you run an older branch, look to your operating system vendor or third-party providers (like TuxCare’s Endless Lifecycle Support) for fixed builds, or containerize using a pre-patched image. Always remember to restart your web server or PHP-FPM service after patching to terminate active, vulnerable workers.
How the Vulnerabilities Work
Both flaws exploit weaknesses in how PHP handles heap memory allocation and cleanups when forced into abnormal or fatal states. [1, 2]
| Vulnerability | Mechanism | Exposure & Target |
|---|---|---|
| CVE-2026-109618 (Out-of-Memory Corruption) | Occurs when PHP is forced out of memory while parsing incoming request data. The data structure is left partially uninitialized, but during request cleanup, PHP mistakenly treats the garbage heap data as valid, opening a path to code execution. | Highest Risk: Unauthenticated RCE. Fully validated over HTTP against Apache mod_php configurations using default limits. |
| CVE-2026-109619 (Stale Global State / Use-After-Free) | Triggered when a request dies abruptly, leaving global pointers pointing to memory that has been freed. If a persistent PHP worker handles a subsequent request, it may reuse this “stale state” before it resets. | Can lead to unauthenticated RCE or severe remote memory disclosure. A confirmed attack vector utilizes the default session.upload_progress feature. |